Engine | Download Report | Detection | Info |
---|---|---|---|
|
malicious
Score: 100
|
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
|
IP | Country | Detection |
---|---|---|
199.195.253.181 | United States | |
52.68.15.223 | United States |
Name | IP | Detection |
---|---|---|
rnnfibi.hopto.org | 199.195.253.181 | |
www.wizumiya.co.jp | 52.68.15.223 |
Name | Detection |
---|---|
https://www.wizumiya.co.jp/html/user_data/original/images/Ev | |
rnnfibi.hopto.org | |
https://nuget.org/nuget.exe | |
Click to see the 14 hidden entries | |
https://github.com/Pester/Pester | |
http://www.apache.org/licenses/LICENSE-2.0.htmlT | |
https://www.wizumiya.co.jp/=- | |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name | |
https://www.wizumiya.co.jp/html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin | |
https://contoso.com/Icon | |
https://contoso.com/License | |
http://pesterbdd.com/images/Pester.pngT | |
https://contoso.com/ | |
http://www.apache.org/licenses/LICENSE-2.0.html | |
http://pesterbdd.com/images/Pester.png | |
http://nuget.org/NuGet.exe | |
https://www.wizumiya.co.jp/u- | |
https://github.com/Pester/PesterT |
Name | File Type | Hashes | Detection |
---|---|---|---|
C:\Users\user\AppData\Local\Temp\yy0zjl34.dll |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\t20mycit.cmdline |
UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators | # | |
C:\Users\user\AppData\Local\Temp\t20mycit.out |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators | # | |
Click to see the 30 hidden entries | |||
C:\Users\user\AppData\Local\Temp\tm43worv.0.cs |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\tm43worv.cmdline |
UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators | # | |
C:\Users\user\AppData\Local\Temp\tm43worv.dll |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\tm43worv.out |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators | # | |
C:\Users\user\AppData\Local\Temp\yy0zjl34.0.cs |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline |
UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators | # | |
C:\Users\user\AppData\Local\Temp\t20mycit.0.cs |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\yy0zjl34.out |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators | # | |
C:\Users\user\AppData\Roaming\remcos\logs.dat |
data | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.4mIv9YDg.20220121172114.txt |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.D1RoMi0p.20220121172156.txt |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.KCw_zsFX.20220121171948.txt |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.XaMWoUUI.20220121172118.txt |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.p0XZL_7o.20220121172125.txt |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache |
data | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yatvffab.mac.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sbqcuw3q.cze.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0eeuky2.wtr.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmioe5ck.e4k.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n2mec0pm.ex3.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mdkzcoqz.qqx.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5juvrhk.vf2.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ansctxp0.z0a.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44sbwrlu.vpn.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ey3l5zz.5em.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\RESD568.tmp |
Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols | # | |
C:\Users\user\AppData\Local\Temp\RESADA2.tmp |
Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x47e, 9 symbols | # | |
C:\Users\user\AppData\Local\Temp\Grund.dat |
data | # | |
C:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP |
MSVC .res | # | |
C:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP |
MSVC .res | # |